Exploração pública
Catálogo de exploits
Todo exploit público que catalogamos, num índice só. Busque por CVE, nome do exploit ou tecnologia — e veja, ao lado, o que a falha realmente vale: severidade, probabilidade de exploração e se já está sob ataque.
76.107exploits catalogados
34.679CVEs com exploração pública
24.695testados em laboratório
TodosExploit-DB 24.443Referência 21.692GitHub PoC 13.812VulnCheck XDB 8.460Nuclei 4.233Metasploit 3.467✓ só verificadosrecentespopularesrisco
75.902 exploits
VulnCheck XDB
initial-access
A potential security vulnerability has been identified in Hewlett Packard Enterprise OfficeConnect 1820, 1850, and 1920S
56RISCO
abrir ↗GitHub PoC★ 1
Exploit CVE-2025-1974 with a single file.
ingress-nginx admission controller RCE escalation
85RISCO
abrir ↗Exploit-DB
Cisco Smart Software Manager On-Prem 8-202206 - Account Takeover
A vulnerability in the authentication system of Cisco Smart Software Manager On-Prem (SSM On-Prem) could allow an unauth
85RISCO
abrir ↗Exploit-DB
Typecho 1.3.0 - Stored Cross-Site Scripting (XSS)
A stored cross-site scripting (XSS) vulnerability in Typecho v1.3.0 allows attackers to execute arbitrary web scripts or
41RISCO
abrir ↗Exploit-DB
Cosy+ firmware 21.2s7 - Command Injection
Cosy+ devices running a firmware 21.x below 21.2s10 or a firmware 22.x below 22.1s3 are vulnerable to code injection due
41RISCO
abrir ↗VulnCheck XDB
initial-access
Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code
100RISCO
abrir ↗Exploit-DB
flatCore 1.5.5 - Arbitrary File Upload
An issue was discovered in flatCore 1.4.7. acp/acp.php allows remote authenticated administrators to upload arbitrary .p
23RISCO
abrir ↗GitHub PoC★ 2
Unverified Password Change (CWE-620)
A unverified password change vulnerability in Fortinet FortiSwitch GUI may allow a remote unauthenticated attacker to c
53RISCO
abrir ↗VulnCheck XDB
initial-access
An issue was discovered in Webmin <=1.920. The parameter old in password_change.cgi contains a command injection vulnera
100RISCO
abrir ↗VulnCheck XDB
initial-access
Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code
100RISCO
abrir ↗VulnCheck XDB
initial-access
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
100RISCO
abrir ↗Exploit-DB
CodeAstro Online Railway Reservation System 1.0 - Cross Site Scripting (XSS)
CodeAstro Online Railway Reservation System Update Employee Page admin-update-employee.php cross site scripting
33RISCO
abrir ↗GitHub PoC★ 18
CVE-2025-22457: Python Exploit POC Scanner to Detect Ivanti Connect Secure RCE
A stack-based buffer overflow in Ivanti Connect Secure before version 22.7R2.6, Ivanti Policy Secure before version 22.7
100RISCO
abrir ↗Exploit-DB
AquilaCMS 1.409.20 - Remote Command Execution (RCE)
A NoSQL injection vulnerability in AquilaCMS 1.409.20 and prior allows unauthenticated attackers to reset user and admin
48RISCO
abrir ↗Exploit-DB
Typecho 1.3.0 - Race Condition
Typecho v1.3.0 was discovered to contain a race condition vulnerability in the post commenting function. This vulnerabil
33RISCO
abrir ↗GitHub PoC★ 2
POC of CVE-2025-3248, RCE of LangFlow
Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code
100RISCO
abrir ↗GitHub PoC★ 9
CVE-2025-24813 poc
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
100RISCO
abrir ↗GitHub PoC★ 9
A vulnerability scanner for CVE-2025-3248 in Langflow applications. 用于扫描 Langflow 应用中 CVE-2025-3248 漏洞的工具。
Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code
100RISCO
abrir ↗GitHub PoC★ 4
TomcatScanner is a comprehensive security tool designed for detecting and exploiting the CVE-2025-24813 vulnerability in Apache Tomcat servers.
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
100RISCO
abrir ↗Exploit-DB
K7 Ultimate Security K7RKScan.sys 17.0.2019 - Denial Of Service (DoS)
K7RKScan.sys in K7 Ultimate Security before 17.0.2019 allows local users to cause a denial of service (BSOD) because of
33RISCO
abrir ↗Exploit-DB
Intelight X-1L Traffic controller Maxtime 1.9.6 - Remote Code Execution (RCE)
An issue in Intelight X-1L Traffic controller Maxtime v.1.9.6 allows a remote attacker to execute arbitrary code via the
48RISCO
abrir ↗Exploit-DB✓ VexDay Proof
DocsGPT 0.12.0 - Remote Code Execution
Remote Code Execution in DocsGPT
68RISCO
abrir ↗GitHub PoC★ 1
A simple, easy-to-use POC for CVE-2025-42813 (Apache Tomcat versions below 9.0.99).
Apache Tomcat: Potential RCE and/or information disclosure and/or information corruption with partial PUT
100RISCO
abrir ↗GitHub PoC
OD&H's scanner for CVE-2024-25600 vulnerability in the Bricks Builder WordPress plugin. For use in Try Hack Me (THM) environments.
WordPress Bricks Theme <= 1.9.6 - Unauthenticated Remote Code Execution (RCE) vulnerability
85RISCO
abrir ↗Exploit-DB
Zohocorp ManageEngine ADManager Plus 7210 - Elevation of Privilege
Privilege Escalation
41RISCO
abrir ↗Exploit-DB
ResidenceCMS 2.10.1 - Stored Cross-Site Scripting (XSS)
A stored cross-site scripting (XSS) vulnerability exists in ResidenceCMS 2.10.1 that allows a low-privilege user to crea
33RISCO
abrir ↗Metasploit600
BentoML's runner server RCE
Insecure Deserialization leads to RCE in BentoML's runner server
75RISCO
abrir ↗Exploit-DB
Apache HugeGraph Server 1.2.0 - Remote Code Execution (RCE)
Apache HugeGraph-Server: Command execution in gremlin
100RISCO
abrir ↗Metasploit600
Langflow AI RCE
Langflow < 1.3.0 Unauthenticated RCE via /api/v1/validate/code
100RISCO
abrir ↗Indexamos apenas o link público para a prova de conceito — nunca hospedamos nem redistribuímos código de exploração. Fontes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit e VulnCheck XDB. A existência de PoC pública não significa que a falha seja explorável no seu ambiente.